Backend Overview

​

Overview

The Conformly.ai backend (conformly-core) is a FastAPI-based REST API that provides AI-powered automotive compliance analysis. It supports multiple industry standards including ASPICE, ISO 26262, ISO/SAE 21434, and more. The backend runs on port 8000 locally (via Docker Compose) and is deployed at beta-api.conformly.ai in production.

---

​

Key Features

---

​

Technology Stack

---

​

Core Components

​

API Layer

The API is organized into versioned endpoint groups under /api/v1/: Key API Features:

• Request/response validation with Pydantic models
• JWT authentication middleware with subscription gating (check_active_subscription)
• CORS configuration via ALLOWED_ORIGINS environment variable
• Structured error handling and logging
• Automatic OpenAPI documentation

​

Services Layer

​

Task Processing

Task Flow:

1. API receives analysis request and creates job record
2. Task enqueued to Redis with job metadata
3. Celery worker picks up and executes LangGraph workflow
4. Progress callbacks update job status in real-time
5. Results persisted to Supabase; Realtime notifies frontend

---

​

Authentication & Subscription

The backend handles user lifecycle through two key endpoints:

• POST /auth/sync — Called on every login. Activates the free plan for new users or migrates a pending Stripe subscription from the pending_subscriptions table.
• GET /auth/me — Returns the user profile with subscription_status and subscription_plan fields.

The check_active_subscription FastAPI dependency can be added to any endpoint to enforce that only users with subscription_status = 'active' can access it.

---

​

Analysis Engines

The backend implements four core analysis engines:

​

1. Gap Analysis

Compares work products against standards to detect missing or insufficient content. Outputs gaps with severity (critical/high/medium/low) and actionable recommendations.

​

2. Completeness Check

Validates document structure against expected templates. Detects placeholders, TBD markers, and missing sections.

​

3. Traceability Check

Analyzes requirement flow across the V-Model lifecycle. Detects orphan artifacts, broken chains, missing evidence, and ASIL inconsistencies.

​

4. Checklist Validation

Applies organization-specific review checklists (ASPICE, FuSa, Cybersecurity). Produces pass/fail/missing/NA evaluations with evidence references.

---

​

Data Model

Core Entities: The profiles table is created automatically by a handle_new_user() database trigger when a user signs up through Supabase Auth.

---

​

API Documentation

When running locally, access interactive API documentation:

• Swagger UI: http://localhost:8000/docs
• ReDoc: http://localhost:8000/redoc

---